567755 - Disabling javascript Date() function with CAPS doesn't work.

Status: RESOLVED WONTFIX

(Core :: Security: CAPS, defect)

Description

[Brandon]

User-Agent:       Opera/9.80 (Windows NT 6.1; U; en) Presto/2.5.24 Version/10.53
Build Identifier: Firefox 3.6.3

I'm trying to disable javascript function Date() or Date().getTime() with CAPS (Configurable Security Policies http://www.mozilla.org/projects/security/components/ConfigPolicy.html ).

I tried the following lines in prefs.js, but none of them works:

user_pref("capability.policy.default.Date.getTime", "noAccess");
user_pref("capability.policy.default.javascript.Date", "noAccess");
user_pref("capability.policy.default.javascript.getTime", "noAccess");
user_pref("capability.policy.default.Window.Date", "noAccess");
user_pref("capability.policy.default.Window.getTime", "noAccess");

What am I missing?

Reproducible: Always

Steps to Reproduce:
Create simple .html file to check if it is disabled:

var d = new Date();
document.write(d.getTime() + " milliseconds since 1970/01/01"); 
Actual Results:  
d.getTime() works.

Expected Results:  
It shouldn't.

Comment 1

[Boris Zbarsky [:bzbarsky]]

1)  CAPS only applied to XPConnect objects, and Date is a native JS object.
2)  CAPS is no longer supported (for example it's not applied on quickstubbed DOM
    object access).  It might happen to work on some properties still, but that's
    by accident, not by design.